26
26 The Story So Far … Single-Step DART: Clicks on each widget once Fully automatic and general-purpose Sufficient to instrument only framework, not apps No need of GUI model unlike work on GUI testing  Applicable to not only framework-defined widgets but also app-defined ones  Portable to other GUI frameworks with little effort Time for a Demo!

32
32 Testing Reactive Programs Given reactive program P and bound k >= 0, which branches in P are reachable by input sequences of length <= k? Naïve Solution: DART(P, k) Computes set of inputs I each of length k such that each (feasible) path in P is taken on some input in I Problem: DART suffers from path explosion

38
38 PRUNE Pattern #2: Independent Events If input sequences π 1 and π 2 of same length: follow symbolic paths p; q; r and p; r; q there is no race on any memory location between segments q and r in π 1 there is no race on any memory location between segments r and q in π 2 then prune either π 1 or π 2

41
41 Path Divergence: Lessons Learnt Unanalyzable parts are common in real programs Divergence is your friend: Served as beacon of bugs in our implementation But debugging is painful: need tools to localize its cause; see [Anand & Harrold, ASE’11] ~ 0% today in our implementation for Android (compared to ~ 40% for SAGE)

42
42 Ongoing Work: Finding Opaque Code Effects Given analysis A and program P with set of opaque methods M, which results of analysis A on program P may be affected by which methods in M? Key goal: reduce human burden of method models Key insights: Most opaque methods are in heavily reused libraries => Reuse models across programs or even analyses Many analyses are lazy or parts of their results unused => Seek models that only affect results that matter

43
43 Symbolic Input Values Which inputs to treat symbolically and where? Too many => path explosion and path divergence Too few => loss of coverage Too early => path divergence from missed propagation in uninstrumented code Too late => path divergence from lost constraints Lessons learnt: Use as few symbolic inputs as possible, but no fewer Inject them as late as possible, but no later

47
47 The Need for Path-Sensitive Analysis Path-sensitive analysis is needed to avoid explosion of infeasible paths What about explosion of feasible paths? Results from certain kinds of features: Small number of widgets but app-specific selection Large number of widgets with framework selection Gestures